Bug 811307 - CUPS does not print when firewalld is running
CUPS does not print when firewalld is running
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: firewalld (Show other bugs)
17
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Thomas Woerner
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-04-10 12:39 EDT by cblaauw
Modified: 2013-01-08 05:14 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-05-23 12:03:08 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Comment (126.38 KB, text/plain)
2012-04-11 16:29 EDT, cblaauw
no flags Details

  None (edit)
Description cblaauw 2012-04-10 12:39:04 EDT
Description of problem:

If I try to print a document, it gets printed only when firewalld is not running.
Is there documentation how the needed ports can be enabled in the new firewall?


  
Actual results:


Expected results:


Additional info:
Comment 1 Jiri Popelka 2012-04-10 13:11:40 EDT
Can you attach an output from Printing troubleshooter when you try to print with firewalld running ?
https://fedoraproject.org/wiki/Printing/Debugging#Printing_troubleshooter
Comment 3 cblaauw 2012-04-11 16:29:33 EDT
Created attachment 915438 [details]
Comment

(This comment was longer than 65,535 characters and has been moved to an attachment by Red Hat Bugzilla).
Comment 5 Jiri Popelka 2012-04-12 10:01:54 EDT
Does that change anything when you edit /etc/firewalld/firewalld.conf,
change DefaultZone=public to DefaultZone=internal or to DefaultZone=trusted,
and run 'systemctl restart firewalld.service' ?
Comment 6 cblaauw 2012-04-12 11:58:06 EDT
DefaultZone=internal works
DefaultZone=trusted works, too
Comment 7 Jiri Popelka 2012-04-12 12:15:20 EDT
Thanks, what about 'DefaultZone=work' ?
Comment 8 cblaauw 2012-04-12 12:45:55 EDT
DefaultZone=work also works
Comment 9 cblaauw 2012-04-16 01:33:24 EDT
I think it would be a nice thing, if it was possible to use a printer even in the default setup of the firewall, or to configure it automatically, when a printer is added.
Comment 10 cblaauw 2012-04-19 14:29:24 EDT
I changed my default zone to 'work', that works. How can I enable the port 25565 permanently?
Comment 11 cblaauw 2012-04-19 15:17:00 EDT
So, I tried it myself by looking at the files in /usr/lib/firewalld and /etc/firewalld. First I created a new file /etc/firewalld/services/minecraft.xml that defines tcp port 25565. Second I copied internal.xml to /etc/firewalld/zones/cb.xml, added the service 'minecraft' there and changed the default zone to 'cb'. So far that seems to work. Is there a way to do something like this with less manual work or is that just the way to do it?
Comment 12 Jiri Popelka 2012-04-20 04:44:46 EDT
(In reply to comment #11)
> Is there a way to do something like this with less manual work or is that
> just the way to do it?

Brilliant! That's indeed the way.
There will finally be a documentation to this in the next firewalld release, but you don't need it anymore :)
We don't have a GUI (firewall-config) yet so this is really the only way to do it at the moment.
Comment 13 cblaauw 2012-04-20 13:24:40 EDT
One last question, is there some kind of inheritance regarded the files in /etc/firewalld and /usr/lib/firewalld are is copying from /usr/lib/firewalld to /etc/firewalld always necessary?

Thanks!
Comment 14 Thomas Woerner 2012-04-20 13:55:39 EDT
No, there is no inheritance. The files in /usr/lib/firewalld are overloaded by the files in /etc/firewalld. Only immutable zones can not be overloaded.

You should copy the files over to /etc/firewalld that you want to modify.
Comment 15 Jiri Popelka 2012-05-23 12:03:08 EDT
Closing. The way how to permanently allow a service or add a port is described in man pages shipped with firewalld-0.2.5-1.fc17.
https://admin.fedoraproject.org/updates/firewalld-0.2.5-1.fc17
Comment 16 Per Inge Mathisen 2013-01-08 05:14:57 EST
The gnome printer config tricks the user into installing firewalld, which has no configuration program yet. Attempting to start the old firewall configuration program tells you to start firewall-config, which does not yet exist in F17. Attempting to print will show the print job forever stuck in the print queue because firewalld does not open the necessary port. As a user, you are supposed to understand somehow that the problem is with the firewall, and fix it by reading firewalld's man page and knowing somehow which port/service you need opened.

User-friendliness at its absolutely worst.

I suggest you fix this problem at its root by removing gnome printer config until it works with the rest of your software stack.

Note You need to log in before you can comment on or make changes to this bug.